Security
A posture, written down.
Reporting is about numbers that matter. The platform underneath is designed like the platform you would expect. Encrypted at rest. Encrypted in transit. Scoped by default. Audited for every action.
What ships today
The controls in place now.
TLS
In transit
At rest
Encrypted storage
Scoped
Per workspace
Logged
Every action
The audit log is not a bolt on. Every action attaches an actor, a timestamp, and a payload. You can read it, filter it, and export it to CSV or JSON.
Questions
Honest answers.
Are you certified to a specific standard?+
Not yet. We are a small team and have not pursued formal certification. We follow the controls you see on this page and answer security questionnaires directly. If you need a specific control, write to us and we will tell you the state plainly.
Do you store my source data?+
Only the slices needed for a report. Cached reads expire within a run. Longer term storage is opt in per source and clearly labeled in the connection settings.
Can I rotate a key?+
Any time, from Settings. API keys, webhook secrets, and connection tokens are all rotatable without downtime.
What about deletion?+
Delete a workspace and associated data is removed from primary storage within seven days and from backups on the backup retention cycle.